v147 · Security · WebTransport · LNA

WebTransport LNA Threat Model

Chrome 147 adds Local Network Access restrictions to WebTransport connections. Compare the attack surface before and after, and explore the QUIC preflight mechanism that prevents malicious public pages from probing private network devices via WebTransport.

attack scenarios

Pre-Chrome 147 — public page → private device

A malicious ad or compromised page could open a WebTransport session to any private IP without restriction.

1. Attacker publishes malicious page at https://evil.example.com
2. Page opens WebTransport to wss://192.168.1.1:443
3. No preflight check — QUIC connection established
4. Attacker probes/exploits router admin interface
✗ No protection

Chrome 147+ — LNA preflight required

Public pages must pass an LNA preflight before establishing a WebTransport session to a private IP.

1. Page requests WebTransport to wss://192.168.1.1:443
2. Browser sends QUIC preflight with Private-Network-Access header
3. Server must reply with Allow-Private-Network: true
4. If missing → browser blocks connection. Attack prevented.
✓ Protected

target tester

Classify a WebTransport target or try a short WebTransport.ready probe.

preflight header exchange

# Browser sends (QUIC CONNECT or HTTP/3 OPTIONS): :method = CONNECT :protocol = webtransport :path = / Access-Control-Request-Private-Network: true Origin: https://myapp.com # Private-network server must respond: HTTP/1.1 200 OK Access-Control-Allow-Origin: https://myapp.com Access-Control-Allow-Private-Network: true ← mandatory # If absent → browser cancels the QUIC session with an error

live LNA scope checker

This browser's WebTransport + LNA status:

references

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗